This short guide helps to get started with setting up a Certificate Authority and a certificate for use in SSL.

Creating a CA and SSL Certificate

1. Create a root private key for signing certificates. (Done only once)
$ openssl genrsa -des3 -out rootCA.key 2048

2. Self-sign this certificate
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem

3. Create a certificate (Done once per device)
$ openssl genrsa -out my-cert.key 2048

4. Now generate a CSR
$ openssl req -new -key my-cert.key -out my-cert.csr

5. Sign the CSR with the root CA key.
$ openssl x509 -req -in my-cert.csr -CA rootCA.pem -CAkey rootCA.key -CACreateSerial -out my-cert.crt -days 1024 -sha256


References:
1. https://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/
2. https://www.sslshopper.com/article-how-to-create-a-self-signed-certificate.html
3. https://www.mulesoft.com/tcat/tomcat-ssl